# Dysphoria: Six Days After the Takedown, and Eight Years After the Idea

## Summary

On 19 March 2026, authorities in the United States, Canada and Germany disrupted the infrastructure behind the four largest IoT botnets ever documented — Aisuru, Kimwolf, JackSkid and Mossad. More than three million infected devices. More than 316,000 DDoS attack commands, including attacks against IP addresses belonging to the US Department of Defense Information Network. Authorities seized **virtual servers, internet domains and other infrastructure**.

**Six days later**, XLab captured the first sample of a new botnet family built directly on JackSkid's code. By the time XLab and CNCERT published their joint report on 25 July 2026, it had more than **200,000 bots**.

They named it **Dysphoria**. What matters is not the scale — 200,000 is far smaller than three million — but the architecture. Dysphoria is engineered to **own none of the three things the takedown seized**:

*   No ICANN domains; it uses ENS (Ethereum) and SNS (Solana) blockchain domains instead
    
*   No attacker-owned C2 servers; victim devices themselves become the relay nodes
    
*   No single-chain dependency; fallback lives across multiple blockchains When the C2 node is the victim's own router, "seizing the C2 infrastructure" stops being a legally meaningful proposition.
    

**Priority action: disable UPnP on edge devices, and check whether any router, camera or IoT device on your network is querying blockchain name resolution services — that is behaviour with essentially no legitimate use case on IoT hardware.**

* * *

## Background: The March 2026 Takedown and What Followed

The 19 March operation was a large coordinated effort. The US Department of Justice led it, alongside law enforcement actions in Canada and Germany targeting the individuals operating the botnets. The private-sector partner list is long: Akamai, AWS, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B — and **QiAnXin XLab**.

| Botnet | DDoS commands | Characteristics |
| --- | --- | --- |
| Aisuru | 200,000+ | Emerged late 2024; behind a series of record-breaking DDoS attacks |
| JackSkid | 90,000+ | Targeted devices on internal networks; grew via residential proxies; averaged 150,000+ daily victims in early March, peaking at 250,000 on 8 March |
| Kimwolf | 25,000+ | Android variant of Aisuru, seeded from it in October 2025; took over 2 million+ Android TV devices |
| Mossad | 1,000+ | Smaller in scale; averaged 100,000+ daily victims in early March |

On firepower, Aisuru and Kimwolf are tied to the largest DDoS attack ever recorded: **31.4 Tbps and 200 million requests per second**, lasting only 35 seconds. Cloudflare characterised the combined maximum attack traffic of the two botnets as equivalent to the combined power of substantial infrastructure.

An intelligence detail worth noting: **XLab was both a participant in the cleanup and the first to see what grew back.** That gives the Dysphoria report particular weight — it was written by people who watched both ends of the cycle.

Krebs on Security identified an important pattern beforehand: after Synthient publicly disclosed the vulnerability Kimwolf was using to propagate (2 January 2026), Kimwolf's spread slowed noticeably. But **several other IoT botnets emerged that effectively copy Kimwolf's spreading methods**, competing for the same pool of vulnerable devices. Dysphoria arrived into exactly that competitive environment.

### The Blockchain Idea Is Not New — the Scale Is

Before the technical detail, Dysphoria needs placing in history.

On 13 September 2018, 360Netlab published **Fbot** — a Mirai variant related to Satori, notable for peculiar behaviour: it scanned TCP port 5555 (the ADB service on Android), located and uninstalled the `com.ufo.miner` cryptomining malware, killed mining processes, then self-destructed. The DDoS module inherited from Mirai remained in the code, but 360Netlab logged no attack commands from its C2.

What makes Fbot memorable eight years on lies elsewhere: **its C2 was** `musl.lib`**, a domain not registered with ICANN and unresolvable through the traditional DNS system.** It resolved through EmerDNS, the blockchain-based DNS of the Emercoin platform. 360Netlab assessed that this choice raised the bar for researchers trying to find and track the botnet, and made sinkholing the C2 domain harder.

That was 2018. Dysphoria does the same thing in 2026, but on **ENS and SNS** — the name services of Ethereum and Solana, two blockchains with millions of legitimate users. The difference is not the idea but the ecosystem: EmerDNS was a niche; ENS and SNS cannot be blocked without broad collateral impact.

And Dysphoria inherits from Fbot directly. XLab documents an `fbot` variant within this botnet's own evolutionary line.

> **An observation of ours, at moderate confidence.** 360Netlab's 2018 IOC list for Fbot includes a related C2 domain: `ukrainianhorseriding.com`. XLab's 2026 IOC list for Dysphoria includes the ENS domain: `ukranianhorseriding.eth`. The same unusual phrase, eight years apart, moved from a conventional `.com` to an Ethereum ENS name; they differ by one letter (`ukrainian` versus `ukranian`), which could be a typo or deliberate. **No source in this material asserts that connection**, and we do not infer that the same individual is behind both. But if the observation holds, Dysphoria's lineage may be more than code reuse from Fbot — it may be an operational continuation. Verify independently before using this in formal reporting.

* * *

## Timeline

| Date | Event |
| --- | --- |
| 13 Sep 2018 | 360Netlab publishes **Fbot** — C2 `musl.lib` resolved via EmerDNS, removes `com.ufo.miner` |
| Late 2024 | **Aisuru** emerges |
| Oct 2025 | **Kimwolf** seeded from Aisuru; spreads via residential proxies |
| Nov–Dec 2025 | Record 31.4 Tbps DDoS attributed to Aisuru/Kimwolf |
| 2 Jan 2026 | Synthient discloses the vulnerability Kimwolf used to propagate |
| 18 Mar 2026 | Nokia Deepfield reports a new Mirai-derived botnet targeting Android TV boxes via ADB |
| **19 Mar 2026** | **DOJ and partners disrupt Aisuru, Kimwolf, JackSkid, Mossad** |
| **25 Mar 2026** | **XLab captures the first Dysphoria sample** (`jackskid` variant, via ENS `m3rnbvs5d.eth`) |
| 1 Apr 2026 | `fbot` variant appears |
| 29–30 Apr 2026 | New custom RC4 string encryption; ENS `ukranianhorseriding.eth` |
| Early May 2026 | First use of Solana SNS: `24carnforth2merseyside.sol` |
| 10 Jun 2026 | New ENS domain: `burrberry.eth` |
| **25 Jun 2026** | **Pure relay variant** — all DDoS modules stripped, relay only |
| 27–28 Jun 2026 | Automated UPnP added; hybrid "DDoS sample + dynamic relay node list" C2 chain completed |
| 14–20 Jul 2026 | Monitoring window: peak of 239,000 overseas bots online per day |
| 25 Jul 2026 | XLab and CNCERT publish their joint report |

XLab emphasises the iteration speed: from a simple `jackskid` sample in late March to a complete hybrid architecture by late June — roughly three months, with meaningful upgrades arriving weeks apart.

* * *

## Technical Analysis

### Propagation

Dysphoria spreads primarily through **weak-credential brute-forcing over Telnet and SSH** and exploitation of known remote code execution flaws in IoT devices — routers, gateways, cameras and other embedded Linux systems. XLab stresses that Telnet/SSH weak-password attacks remain the primary and most stable infection method, with exploitation as a complementary channel.

The CVE list deliberately mixes old and new:

```plaintext
CVE-2013-3307        CVE-2020-8515        CVE-2025-9528
CVE-2016-20016       CVE-2020-25499       CVE-2025-28137
CVE-2017-5259        CVE-2022-35733       CVE-2025-34152
CVE-2017-17215       CNVD-2021-79445      CVE-2025-55182
CVE-2018-14558
```

It includes classic IoT flaws long exploited by botnets — CVE-2017-17215 (Huawei), CVE-2020-8515 (DrayTek) — alongside recently disclosed ones: CVE-2025-55182 ("React2Shell"), CVE-2025-34152, CVE-2025-28137 (TOTOLINK), CVE-2025-9528 (Linksys). Maintaining both groups indicates the operators continue actively updating propagation capability to broaden coverage across device brands and models.

### Disguise and String Protection

Both sample types — DDoS and relay — share one runtime characteristic: they **rename their own process to** `libdalvikengine.so`, posing as an Android system library.

For string protection, the latest `fbot` variant uses a notably modified RC4 algorithm which XLab assesses borrows partly from `jackskid`'s design thinking:

*   **KSA stage 1:** standard RC4 initialisation with a 16-byte key
    
*   **KSA stage 2:** a linear congruential generator (LCG) shuffles the S-box a further **five rounds**
    
*   **PRGA:** a linear feedback shift register (LFSR) step is folded into keystream generation, with two swap operations and complex bit shifts XLab published a full Python reimplementation of the algorithm in the original report — worth taking if your team needs to analyse samples.
    

### Blockchain-Based C2 Resolution

Dysphoria supports both ENS (Ethereum Name Service) and SNS (Solana Name Service). It queries `TXT` or custom records on these domains, with the following key mapping:

| Type | Domain | Query key | Role |
| --- | --- | --- | --- |
| ENS | `burrberry.eth` | `node` | Retrieve relay distribution node IPs |
| ENS | `ukranianhorseriding.eth` | `network` | Base network infrastructure |
| SNS | `24carnforth2merseyside.sol` | `deserialized` | Base network infrastructure |

**The fake IPv6 obfuscation layer.** The retrieved record does not contain the real IP in plaintext. It contains a series of **fake IPv6 addresses** separated by the `|` character — for example `2001:db8:12e7:13d7::1`. The sample performs byte-by-byte string comparison to filter out the four significant bytes, then passes them through a custom permutation function to recover the real IPv4 address.

That function rotates nibbles, rotates right by position, then XORs and adds against a hardcoded 32-bit key. In XLab's worked example, the four bytes from `12e7:13d7` decode to `144.31.38.215`.

The result: **the attacker's server address appears in plaintext nowhere** — not in the malware sample, not in DNS traffic, not in the blockchain record.

### The Three-Tier Dynamic C2 Chain

This is the sharpest piece of design, and the reason tracing is so difficult:

1.  The DDoS sample resolves the `node` record of `burrberry.eth` and decrypts a set of **distribution node** IPs (such as `144.31.38.215`).
    
2.  It sends an HTTP GET to those nodes at `http://<node_ip>:9000/nodes?key=meowmeowmeow`.
    
3.  The returned IP list is used by the sample as its actual C2 addresses. But when XLab traced backwards they found the single most important fact in the report: **every one of those "real" C2 addresses is another infected host that has been converted into a relay node.**
    

There is no attacker-owned infrastructure tier left to seize. Bots talk to bots.

### Network Protocol

Building on `fbot`, Dysphoria rewrites its lower-layer communication protocol. Login and heartbeat packets are both a fixed **78 bytes**:

```plaintext
Login Packet (78 bytes):
[0---1]  [2--------13]  [14--15]  [16------15+len]  [padding]
Type(2B)  Magic(12B)     Length    Value (dynamic)   Padding
 
Heartbeat Packet (78 bytes):
[0---1]  [2--------13]  [14----------------------------77]
Type(2B)  Magic(12B)              Padding
```

*   Login magic: `00 80 00 5a 00 57 00 c8 00 f0 00 1e` — MsgType `02 00`
    
*   Heartbeat magic: `22 ba 15 24 1a 6f 04 d4 1f 9c 0d 06` — MsgType `00 00` Attack commands use a multi-level nested structure: `Duration(2B) | AtkType(1B) | TargetCnt(1B) | targets[] | FlagCnt(1B) | flags[]`, where each target holds an IP (4B) and netmask (1B), and each flag holds an Option (1B), Length (2B) and Value.
    

The fixed 78-byte packet size and the two magic strings are among the few artifacts usable as a network-layer signature.

### The Relay Variant: Turning Victims Into Infrastructure

The standalone variant that appeared in late June is functionally pure: **it strips out every DDoS attack module and does nothing but convert infected hosts on internal networks into covert relay stations for the operation.**

**Automated NAT traversal via UPnP.** Because most IoT devices and personal computers sit behind NAT, external parties cannot connect directly. On launch, the relay sample broadcasts across the LAN searching for gateway devices supporting UPnP, then invokes the WAN connection service to **map 155 ports on the router**.

**Bidirectional non-blocking relay via epoll.** The infected host listens on those 155 ports. When external traffic connects to one of them at `bot:P`, the relay sample immediately opens an outbound connection to the real remote `c2:P` (the same port number), then uses Linux's high-performance asynchronous non-blocking `epoll` I/O to bind the two connections and transparently relay data in both directions.

**Status reporting.** Every four seconds or so, the relay node sends a JSON health report to the heartbeat collection domain `login.trees4sale.net:9000`, declaring its own availability:

```json
{
  "status": "ONLINE",
  "connections": 42,
  "bandwidth_mbps": 12.5
}
```

The `bandwidth_mbps` field is telling: the node self-reports its available bandwidth. This is the behaviour of a system **managing infrastructure capacity**, not a botnet merely counting infections.

* * *

## Scale and Business Model

![Active C2 trend](https://blog.xlab.qianxin.com/content/images/2026/07/------2026-07-16-15.46.01.png align="center")

*Trend in active C2 count, including relay nodes (source: XLab).*

During the monitoring window from 14 to 20 July 2026, XLab recorded:

*   **4,401** confirmed active bots inside China
    
*   A peak of **1,801** domestic bots online per day
    
*   A peak of **740,000** daily bot connections to C2
    
*   A peak of **239,000** overseas bots online per day That last figure dwarfs the domestic count, and XLab explains why: because Dysphoria uses controlled bots as C2 relays, the overseas bot population is more observable to them.
    

![Domestic bot scale](https://blog.xlab.qianxin.com/content/images/2026/07/640.png align="center")

*Daily online bot count within China (source: XLab).*

From control panel screenshots leaked on social media, Dysphoria's bot population has held long-term at roughly 200,000. XLab cross-checked that figure against its own continuous monitoring data and found it broadly consistent — good corroboration, and an indication the leaked screenshot is credible.

![Leaked control panel](https://blog.xlab.qianxin.com/content/images/2026/07/2026-07-10-15.48.14.jpg align="center")

*Leaked Dysphoria control panel screenshot circulating on social media (source: XLab).*

On commercialisation, Dysphoria's public promotion page claims a maximum DDoS capacity of roughly **4 Tbps**, selling attack packages ranging from tens to hundreds of US dollars depending on duration and bandwidth. XLab assesses this as a comparatively mature commercial operating model.

![Service storefront](https://blog.xlab.qianxin.com/content/images/2026/07/dysphorianetwork.st-2026-07-10-15.54.10.png align="center")

*Commercial operating model and service tiers on the public promotion page (source: XLab).*

The 4 Tbps figure needs context: it is far below the 31.4 Tbps record set by Aisuru/Kimwolf. But it remains enough to cause significant disruption to most organisations without large-scale DDoS protection.

![Attack target trend](https://blog.xlab.qianxin.com/content/images/2026/07/------2026-07-16-15.45.46.png align="center")

*Trend in Dysphoria's DDoS attack targets (source: XLab).*

On attack activity, Dysphoria's targets span the globe across multiple industries including internet services and gaming. Continuous monitoring shows attack activity occurring nearly every day, sustaining a high overall level of activity.

* * *

## Indicators of Compromise

> Indicators taken from the [joint QiAnXin XLab and CNCERT report](https://blog.xlab.qianxin.com/dysphoria/). Domains are defanged. Re-fang only in controlled environments.

**Download / C2 server IPs**

```plaintext
217.60.195[.]160
76.164.203[.]171
92.42.100[.]131
78.153.155[.]152
144.31.38[.]215        # distribution node, decoded from the ENS record
```

> These servers also carry a distinctive FTP banner usable as a detection signature. The banner string contains an insult directed at a security journalist and is not reproduced here; see XLab's original report for the full value if you need it to build a rule.

**Infrastructure domains**

```plaintext
i.peer4you[.]net
o.peer4you[.]net
login.trees4sale[.]net           # relay node heartbeat collection, port 9000
www.trees4sale[.]net
c2.saintpetersburgresident[.]ru
peer.saintpetersburgresident[.]ru
kieron.androiddebugbridge[.]su
dysphoria.androiddebugbridge[.]su
telaviv.androiddebugbridge[.]su
jerusalem.androiddebugbridge[.]su
node.androiddebugbridge[.]su
wow.androiddebugbridge[.]su
```

> The `androiddebugbridge[.]su` cluster of six subdomains is worth noting — the domain names the ADB protocol directly, the same vector Fbot used to spread in 2018 and that Nokia Deepfield observed again in March 2026.

**Blockchain domains**

```plaintext
m3rnbvs5d[.]eth                  # ENS — initial jackskid variant
burrberry[.]eth                  # ENS — key "node", relay distribution nodes
ukranianhorseriding[.]eth        # ENS — key "network"
24carnforth2merseyside[.]sol     # SNS — key "deserialized"
```

**Sample hashes (SHA-1)**

```plaintext
c1bedea261f325441fb9a75c50b11d0c8fb01ac6    # jackskid variant, 25 March
a3b9575897c16cbf6afe3af1aa8b55171ea6edf9
8db6c78533c176f13b61405cdc3f8fad703325f1
9c1716d770ea69e8e1418d96d52222396ecb4362
73651c02b29f1c07e3177e86c967fc45e9f30f0f
955ff909972958098f0d4a06bcc4d6b9eea90449
25081bdec05f64eb4f313420c82d8de957e30026
dcea71b9ab9de8efca301de9e2f7bf11c7132364
df510f6f69a5c149c216c7b3accc4f460d8cf363
b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be    # pure relay variant, 25 June
e7e1694162639ed587625432a79cfaa49f560d11
b7faa44ab0772047a8581bbfdd9c561e28fc66de
```

**Behavioural and network artifacts**

```plaintext
# On device
Process name: libdalvikengine.so            (both DDoS and relay samples)
155 UPnP port mapping rules created on the gateway
Distinctive string: "android has no compatible libc library"   (jackskid variant)
Distinctive string: "hail china mainland"                      (fbot variant)
 
# On the network
ENS / SNS resolver queries originating from routers, cameras or IoT devices
Fixed 78-byte TCP packets carrying magic values:
  00 80 00 5a 00 57 00 c8 00 f0 00 1e    (login, MsgType 02 00)
  22 ba 15 24 1a 6f 04 d4 1f 9c 0d 06    (heartbeat, MsgType 00 00)
HTTP GET to  <ip>:9000/nodes?key=meowmeowmeow
JSON POST to port 9000 with fields: status / connections / bandwidth_mbps
Pipe-separated IPv6 strings inside blockchain domain TXT records
TCP 23 and 22 scanning (Telnet/SSH brute force) from internal devices
```

**Exploited CVEs**

```plaintext
CNVD-2021-79445    CVE-2018-14558    CVE-2025-9528       (Linksys)
CVE-2013-3307      CVE-2020-25499    CVE-2025-28137      (TOTOLINK)
CVE-2016-20016     CVE-2020-8515     (DrayTek)           CVE-2025-34152
CVE-2017-17215     (Huawei)          CVE-2022-35733      CVE-2025-55182 (React2Shell)
CVE-2017-5259
```

* * *

## MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | Observed in campaign |
| --- | --- | --- | --- |
| Initial Access | T1110.001 | Brute Force: Password Guessing | Telnet/SSH weak-credential brute-forcing |
| Initial Access | T1190 | Exploit Public-Facing Application | 13 CVEs across routers, cameras, gateways |
| Initial Access | T1078.001 | Valid Accounts: Default Accounts | Default credentials on IoT devices |
| Execution | T1059.004 | Unix Shell | Shell scripts deploying the payload |
| Defense Evasion | T1036.004 | Masquerading: Masquerade Task or Service | Process renamed to `libdalvikengine.so` |
| Defense Evasion | T1027 | Obfuscated Files or Information | Modified RC4 with LCG and LFSR |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | String decryption and IP recovery from fake IPv6 |
| Command and Control | T1102 | Web Service | ENS and SNS as dead drop resolvers |
| Command and Control | T1568.003 | Dynamic Resolution: DNS Calculation | Byte permutation recovering IPv4 from fake IPv6 |
| Command and Control | T1008 | Fallback Channels | Multi-chain fallback (Ethereum and Solana) |
| Command and Control | T1090.001 | Proxy: Internal Proxy | Relay nodes inside victim networks |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy | Real C2 addresses are other bots acting as relays |
| Command and Control | T1572 | Protocol Tunneling | Bidirectional epoll relay across 155 ports |
| Command and Control | T1571 | Non-Standard Port | Port 9000 for node distribution and status reporting |
| Command and Control | T1105 | Ingress Tool Transfer | Payload retrieval from distribution servers |
| Impact | T1498 | Network Denial of Service | Commercial DDoS service |
| Impact | T1498.001 | Direct Network Flood | Attack types selected via `AtkType` |
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | Registration of ENS and SNS domains |

> `[NEEDS VERIFICATION]` — two points to check before building a Navigator layer. First, T1568.003 (DNS Calculation) describes computation from returned DNS values; Dysphoria's mechanism is byte-permutation decoding from a blockchain record — close, but not an exact match. Second, **there is no dedicated technique for abusing ENS/SNS as C2 resolution infrastructure** — T1102 (Web Service) is the best available placement, but it does not capture the "unseizable" property that is the entire reason the attackers chose this mechanism.

* * *

## Assessment

**Dysphoria is an engineering response, not simply a new botnet.**

The DOJ announcement specified that the March takedown targeted virtual servers, internet domains and other infrastructure. Three months later, Dysphoria completed an architecture in which none of those three exist in a seizable form:

*   **Domains:** ENS and SNS have no registrar to receive a court order. Records live on a distributed ledger and are updated by blockchain transaction.
    
*   **C2 servers:** the addresses bots actually connect to are other victims' routers and cameras.
    
*   **Fallback infrastructure:** spread across two independent blockchains. When the C2 node is the victim's device, "seizing the C2 infrastructure" means "seizing the routers of hundreds of thousands of households and businesses worldwide". No legal system executes that at scale.
    

**But the takedown deserves fair treatment.** It was a genuine success: more than three million devices freed from control, and authorities in Canada and Germany went after the people operating the botnets rather than just the infrastructure. The scale comparison says something too: Dysphoria currently has 200,000 bots and advertises 4 Tbps, against three million devices and 31.4 Tbps for the previous generation. The takedown reset the clock. The problem is that it could not reset the idea.

**On the idea not being new.** Fbot used blockchain DNS in 2018, and 360Netlab warned precisely what would follow: security systems fail if they only look for traditional DNS names. Eight years on, that warning now applies to a 200,000-device botnet rather than an odd worm that went around deleting cryptominers.

What changed in those eight years is the **ecosystem**. EmerDNS in 2018 was a niche; blocking it entirely would have affected almost nobody. ENS and SNS in 2026 are not — they have millions of legitimate users and are integrated into mainstream wallets and applications. Blocking them at the enterprise layer is feasible; blocking them at the internet infrastructure layer is not. This is the same logic we have seen with `*.workers.dev` and other cloud services: **the barrier is not technical but collateral.**

**The cheapest detection point in the whole article:** a router, IP camera or DVR issuing queries to a blockchain name resolution service is behaviour with essentially no legitimate use case. IoT devices have no business reason to look up ENS or SNS names. The signal is low-noise, requires no prior knowledge of a malware name, and sits at exactly the chokepoint the entire C2 chain must pass through.

### Relevance for Vietnam

**The CVE list lands squarely on locally common hardware.** TOTOLINK (CVE-2025-28137) and DrayTek (CVE-2020-8515) are both widely deployed across Vietnamese small and medium businesses and households. Huawei HG532 (CVE-2017-17215) was distributed by ISPs to subscribers and remains in circulation. This is not a list aimed at large enterprise infrastructure — it targets what sits in the network cabinet of every small office.

**Two configuration habits raise the risk.** First, default Telnet and SSH credentials are rarely changed on network hardware in small offices and homes — and XLab confirms this remains the primary infection channel, more reliable than exploitation. Second, **UPnP is enabled by default** on most consumer routers, and that is exactly the mechanism the relay variant uses to open 155 ports.

**The biggest risk is not bandwidth.** With an ordinary DDoS botnet, an infected victim's loss is mainly bandwidth and device performance. Dysphoria's relay variant changes that: your device becomes **C2 infrastructure serving attacks against other organisations**.

The practical consequence for a business: your company's public IP appears in another country's victim logs as **attack infrastructure**, not as a victim. That carries legal exposure, exposure to provider blocklists, and reputational exposure when international partners run their reviews. For companies delivering services to overseas clients, this belongs in the risk assessment rather than being filed as "a device got infected".

* * *

## Recommendations

*   **Disable UPnP on edge devices** unless there is a clear business need, and audit existing port-mapping rules on routers now — 155 new rules is an unmistakable indicator.
    
*   **Change default credentials and disable Telnet** across all routers, cameras, DVRs and embedded Linux devices; block administrative access from the WAN side.
    
*   **Monitor ENS/SNS resolver queries originating from IoT network segments** — IoT devices have no legitimate reason to look up blockchain domains.
    
*   **Inventory devices against the CVE list above**, prioritising TOTOLINK, DrayTek and ISP-supplied routers; update firmware or replace end-of-support hardware.
    
*   **Segment IoT away from business networks** and restrict outbound traffic from that segment — a compromised device should not be able to open arbitrary connections to the internet.
    
*   **If compromise is suspected:** isolate the device, reflash firmware to the latest clean image rather than simply rebooting, rotate all credentials, and check whether your organisation's public IP has landed on any blocklists.
    

* * *

## References

*   QiAnXin XLab and CNCERT — [Emerging botnet Dysphoria: evolution and in-depth technical analysis](https://blog.xlab.qianxin.com/dysphoria/) (25 July 2026) — original report, including the Python RC4 decryption script and IP recovery function
    
*   BleepingComputer — [New Dysphoria DDoS botnet spreads to 200k devices worldwide](https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/) (27 July 2026)
    
*   BleepingComputer — [Aisuru, Kimwolf, JackSkid and Mossad botnets disrupted in joint action](https://www.bleepingcomputer.com/news/security/aisuru-kimwolf-jackskid-and-mossad-botnets-disrupted-in-joint-action/) (20 March 2026)
    
*   BleepingComputer — [New Botnet Hides in Blockchain DNS Mist and Removes Cryptominer](https://www.bleepingcomputer.com/news/security/new-botnet-hides-in-blockchain-dns-mist-and-removes-cryptominer/) (17 September 2018)
    
*   360Netlab — [Fbot, A Satori Related Botnet Using Block-chain DNS System](https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/) (2018)
    
*   Krebs on Security — [Feds Disrupt IoT Botnets Behind Huge DDoS Attacks](https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/)
    
*   The Hacker News — [DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks](https://thehackernews.com/2026/03/doj-disrupts-3-million-device-iot.html)
    
*   SecurityWeek — [Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation](https://www.securityweek.com/aisuru-and-kimwolf-ddos-botnets-disrupted-in-international-operation/)
    
*   CyberScoop — [Justice Department disrupts botnet networks that hijacked 3 million devices](https://cyberscoop.com/botnet-disruption-aisuru-kimwolf-jackskid-mossad/)
    
*   Team Cymru — [Team Cymru & DOJ Disrupt World's Largest IoT DDoS Botnets](https://www.team-cymru.com/post/team-cymru-doj-iot-ddos-botnet-disruption)
    
*   Security Affairs — [Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure](https://securityaffairs.com/196182/malware/dysphoria-botnet-uses-blockchain-domains-to-hide-c2-infrastructure.html)
    
*   Help Net Security — [Authorities disrupt four IoT botnets behind record DDoS attacks](https://www.helpnetsecurity.com/2026/03/20/us-disrupts-iot-botnets-ddos-attacks-aisuru-kimwolf/)